From 84c21bcd484eb8c0e983407068c5a6e46ce0d11d Mon Sep 17 00:00:00 2001 From: HAL <68320771+HALQME@users.noreply.github.com> Date: Fri, 10 Apr 2026 23:35:57 +0900 Subject: [PATCH 1/3] Add Cloudflare challenge CSP and captcha placeholder MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update the CSP header to allow Cloudflare challenge URLs, add a frame source for challenges, and insert a `
` container in the sign‑up profile step. Adjust the sign‑up page to use `` instead of hidden divs. --- apps/client/public/_headers | 2 +- .../src/components/signup/SignUpStepProfile.vue | 2 ++ apps/client/src/pages/SignUp.vue | 16 ++++++---------- 3 files changed, 9 insertions(+), 11 deletions(-) diff --git a/apps/client/public/_headers b/apps/client/public/_headers index 68215a03..a92a7927 100644 --- a/apps/client/public/_headers +++ b/apps/client/public/_headers @@ -1,5 +1,5 @@ /* - Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://*.clerk.accounts.dev https://accounts.omu-aikido.com https://clerk.omu-aikido.com https://static.cloudflareinsights.com; connect-src 'self' https://*.clerk.accounts.dev https://accounts.omu-aikido.com https://clerk.omu-aikido.com https://cloudflareinsights.com; img-src 'self' https://img.clerk.com data:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' + Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://*.clerk.accounts.dev https://accounts.omu-aikido.com https://clerk.omu-aikido.com https://static.cloudflareinsights.com https://challenges.cloudflare.com; connect-src 'self' https://*.clerk.accounts.dev https://accounts.omu-aikido.com https://clerk.omu-aikido.com https://cloudflareinsights.com https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; img-src 'self' https://img.clerk.com data:; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin diff --git a/apps/client/src/components/signup/SignUpStepProfile.vue b/apps/client/src/components/signup/SignUpStepProfile.vue index 445c6e71..63d8bba6 100644 --- a/apps/client/src/components/signup/SignUpStepProfile.vue +++ b/apps/client/src/components/signup/SignUpStepProfile.vue @@ -67,6 +67,8 @@ {{ formErrors.legalAccepted }} + +